Foundry SecureIron: Security Switch and Firewall Load Balancer

01 /What SecureIron was

SecureIron was listed alongside ServerIron under the web switches heading on the old Foundry site, which tells you its heritage. It took the ServerIron forwarding engine and flow table and applied them to security rather than load distribution: every flow through the switch was tracked, access control was applied at line rate, and abnormal traffic patterns were dropped in hardware before they reached firewalls or servers.

Foundry positioned it for the network perimeter and the data-center edge, where an organisation already had firewalls but wanted a hardware layer in front of them to absorb floods, enforce coarse policy and spread load across a firewall cluster. The product is obscure; datasheets are scarce and model details vary between sources, so this page describes the concepts rather than exact specifications.

02 /Capabilities

03 /Firewall load balancing explained

Firewalls are stateful, so a flow that enters through firewall A and returns through firewall B is dropped by B, which has no record of it. Firewall load balancing solves this with a sandwich: a switch on the outside picks a firewall for each new flow, and a switch on the inside uses the same hash or a shared table to send the return traffic back through the same firewall. Health checks remove a failed firewall from the rotation. The same technique appeared on ServerIron; SecureIron packaged it with the other perimeter functions. The server load balancing page covers the flow table mechanics.

04 /SYN flood protection and rate limiting

A SYN flood exhausts the connection tables of servers or firewalls with half-open connections. A hardware device in front can absorb this by answering the handshake on behalf of the server and only opening a real connection once the client completes it (a SYN proxy), or by capping the rate of new connections per source and dropping the excess. Rate limiting extends the idea to bandwidth: a per-port or per-flow cap prevents one host or service from saturating an uplink. On SecureIron these functions ran in the forwarding hardware, which was the selling point compared with software firewalls of the period.

05 /Why it was short-lived

The market for a switch-based security appliance was thin. Firewall vendors added their own clustering, so firewall load balancing became a feature rather than a product. Dedicated DoS mitigation moved to purpose-built appliances and, later, to upstream services. Foundry sold few units and did not invest in a second generation, and Brocade dropped the line after the December 2008 acquisition. The load balancing hub covers where the concepts went afterwards.

06 /SecureIron today

Units rarely appear second-hand. Anyone holding one should treat it as a ServerIron variant: the same CLI heritage, the same power and noise profile for the chassis form factor, and no software support since the late 2000s. It must not be used as a security device on a live network because its inspection code has received no updates for well over a decade; see the security advisories page. It is a curiosity for collectors and a teaching aid for the firewall sandwich pattern.